Bekker's Blog

Blog archive

Which Unpatched Holes Most Appeal to Attackers?

There are few better ways to guarantee a system will be breached, compromised and exploited than failing to keep up with vendors' patches. Yet millions of public-facing systems run unpatched.

In an effort to document which previously reported security vulnerabilities are most popular with attackers, government public computer security awareness agencies from five countries on Wednesday released a Top 30 list of targeted high-risk vulnerabilities.

"This Alert provides information on the 30 most commonly exploited vulnerabilities used in these attacks, along with prevention and mitigation recommendations," read an alert from the U.S. Department of Homeland Security's National Cybersecurity and Communications Integration Center and the U.S. Computer Emergency Readiness Team.

An analysis by the Canadian Cyber Incident Response Centre provides the foundation for the list, which was jointly developed by government computer security organizations in Australia, Canada, New Zealand, the United Kingdom and the United States.

The vulnerabilities are not listed by severity. Instead, they are grouped by the vendor or project whose software is affected. Microsoft accounts for 16 of the vulnerabilities, Adobe for 11, Oracle for 2 and OpenSSL for 1.

What's both interesting and depressing about the list is how old some of the vulnerabilities are. For example, in the Microsoft list, some of the 30 most commonly exploited vulnerabilities date to 2009 and 2008, as well as an Internet Explorer malware issue, which first emerged almost nine years ago.

On Microsoft platforms, the attackers' favorite flaws come from the following bulletins:

  • MS08-042
  • MS09-067
  • MS09-072
  • MS10-018
  • MS10-087
  • MS11-021
  • MS12-027
  • MS12-060
  • MS13-008
  • MS13-022
  • MS13-038
  • MS14-012
  • MS14-017
  • MS14-021
  • MS14-060

The malware issue with Internet Explorer is CVE-2006-3227.

The U.S. version of the Top 30 bulletin is available here.

Posted by Scott Bekker on April 29, 2015 at 10:33 AM


Featured

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.

  • Curvey Stone Steps Graphic

    Microsoft Makes Run at 5G, Edge Computing with Azure Edge Zones

    Microsoft is promising to enable new edge computing scenarios for partners and developers with Azure Edge Zones, which became available as a preview this week.

  • Microsoft's Entire 2020 Event Lineup Going 'Digital-First'

    In response to concerns about the ongoing coronavirus (COVID-19) pandemic, Microsoft is transitioning all of its big conferences in 2020 to be online only.

  • Microsoft Adds 'Family' and 'Personal' SKUs to Microsoft 365 Line

    Microsoft is readying two new consumer editions of Microsoft 365 for release in April.

RCP Update

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.